You can actually do this in your search by building the "All" value and then appending the set of individual values. You also have to make sure to use the "fieldforlabel" and "fieldforvalue" properties of the multi select. Your search will look something like this: | inputlookup ServersList | where Environment like "Development" AND ApplicationName like "MyApplication" | stats values(ServerName) as hostValues by _time | eval hostFilter="(host=\"".mvjoin(hostValues, "\" OR host=\"")."\")" | eval ServerLabel = "All" | rename hostFilter as ServerValue | append [| inputlookup ProgServers | where Environment like "Development" AND ApplicationName like "MyApplication" | dedup ServerName | sort +ServerName | rename ServerName as ServerLabel | eval ServerValue = "host=\"".ServerLabel."\"" ] Notice the ServerLabel in the first search is "All", this is what will be displayed in the multi select to the user. The value is a set of OR statements that contain the same values as what is in the second search. Enjoy!! ... View more